CVE-2025-12695

MediumCVSS 5.9

Published: 04/11/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files when users build an AI agent that consumes user input and uses the PythonInterpreter class.

Risk Assessment

Organizations building DSPy-based AI agents that accept user input may be exposed to leakage of sensitive files from the host system. The risk mainly affects environments where agents have access to the local filesystem.

Recommendation

Restrict the privileges of the process running the AI agent and review the DSPy sandbox configuration. Consider running agents in an isolated container without access to sensitive files.

Other vulnerabilities in DSPy

CVE-2026-72742High
DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters. An attacker with influence over language model outputs can read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path, subsequently embedding the contents into outgoing messages to the attacker-controlled endpoint.

Original NVD description (English source)

The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS